The <form> element
The <form> tag groups interactive controls — like <input>, <select>, and <button> — so their values can be collected and submitted together, typically to a server via the action and method attributes. It’s the standard way to build sign-up forms, search bars, and any input that needs to be submitted.
Last updated: October 3, 2026
Quick facts
| Category | Flow content, palpable content |
| Content model | Flow content, but no nested <form> elements |
| Tag omission | Neither the start nor end tag can be omitted |
| Permitted parents | Any element that accepts flow content |
| DOM interface | HTMLFormElement |
Syntax
Live example
Edit the code below and watch the preview update instantly.
Attributes
| Attribute | Description |
|---|---|
| action | URL the form data is sent to |
| method | get or post — how the data is sent |
| enctype | Encoding for the submitted data; use multipart/form-data for file uploads |
| autocomplete | Whether browsers may autofill fields (on/off) |
| novalidate | Skips the browser’s built-in validation on submit |
Common examples
A newsletter signup form
The smallest useful form: one labelled field and a submit button.
A login form with autofill hints
The autocomplete values let browsers and password managers fill the fields correctly.
A file upload form
Uploading files needs method="post" and enctype="multipart/form-data".
GET vs POST
The method attribute decides how the form data travels. With GET, the values are added to the URL (for example /search?q=shoes), so the result can be bookmarked, shared and cached. With POST, the values are sent in the body of the request and don’t appear in the address bar or browser history.
Use GET for searches and filters, where visitors benefit from a shareable URL. Use POST for anything that changes data or contains private information: sign-ups, logins, payments, messages and file uploads. Remember that POST hides data from the URL but does not encrypt it — always serve forms over HTTPS.
| GET | POST | |
|---|---|---|
| Where data goes | In the URL | In the request body |
| Bookmarkable | Yes | No |
| Best for | Search, filters | Logins, sign-ups, uploads |
Common mistakes to avoid
- Fields without a
name. Only fields with a name attribute are sent when the form is submitted. - Missing labels. Placeholder text is not a label. Every field needs a <label>.
- Trusting browser validation alone.
requiredandtype="email"help visitors, but anyone can bypass them, so the server must check the data too. - Sending passwords with GET. GET puts the values in the URL (and browser history); use POST for anything private.
Accessibility & SEO tips
- Group related fields, such as radio buttons, in a <fieldset> with a
<legend>. - Show error messages as text next to the field and link them with
aria-describedby, rather than relying on red borders alone. - Use the right input types and
autocompletevalues: they bring up the correct mobile keyboard and save visitors typing. - Keep forms short: ask only for the information you really need. Every extra field lowers the number of people who finish the form.
Browser support
Supported in every browser, including Chrome, Edge, Firefox, Safari and their mobile versions — it has been part of HTML since the very first versions. Newer input types (date, color, range) also work in all current browsers.
Tutorials: How to make a button, How to make a contact form, HTML forms tutorial